Affected Systems

Dell Container Storage Modules (CSM) all versions prior to 1.17.0. Fixed in version 1.18.0. Affects csm-authorization-storage gRPC server, authorization proxy, tenant service, ContainerStorageModule Custom Resource reconciler, CSM Authorization module, and karavi-authorization JWT authentication component. Impacts all five supported Dell storage product families.

Exploitation Status

No active exploitation reported. However, Dell products have history of active exploitation (CVE-2021-21551, CVE-2026-22769). No workarounds available; patching required.

Business Impact

Complete compromise of Dell storage infrastructure and Kubernetes clusters. Attackers can obtain storage backend admin credentials for all registered arrays, bypass authentication to gain administrative privileges, escalate to root on cluster nodes, forge valid admin tokens using hardcoded credentials, access secrets cluster-wide, and manipulate RBAC controls. Single exploit can compromise all nodes in a Kubernetes cluster. Affects multi-tenant environments with cross-tenant access possible.

Urgency

🔴 Immediate

Recommended Actions

  • Immediately upgrade Dell Container Storage Modules (CSM) to version 1.18.0 on all affected systems
  • Rotate all JWT signing secrets in karavi-authorization and CSM Authorization components after patching
  • Audit Kubernetes cluster logs for unauthorized gRPC server access, anomalous custom resource submissions, and suspicious RBAC modifications prior to patching
  • Review storage backend administrator credentials and access logs for all registered Dell storage arrays for signs of unauthorized access
  • Verify no unauthorized administrative tokens or RBAC resources were created during vulnerable period; revoke any suspicious credentials